The menu however, is only stored in the default tenant tables. So it would not work for other tenants (i.e. sharedMenu would be null).

Q1. Am I right in thinking WebAPI is the correct course here? (I'm guessing I shouldn't be hacking sessionLocator etc.)
Q2. If I do use WebAPI, just to save time, any examples anywhere showing e.g. menu (or other content item) deserialisation via WebAPI?
Q3. Is using WebAPI much cleaner/faster than using a partial Html view on the default site and ajax injecting it? (which would need no deserialisation).

Content Manager (and NH session) is scoped to a tenant - you won't be able to perform cross-tenant queries this way without significant core changes.

A1. I'd go for it and just load those items from JS via WebAPI from the default tenant.
A2. You would need to create your own ApiController that performs a query for menu items and returns the necessary data. Don't return contents of the query directly - they cannot be serialized. You need to create some DTO or use anonymous objects based on the
query results and return those.
A3. Definitely. The drawback is that you'd need to handle HTML generation from JS, not server-side.

@betrand - they are distinct, isolated sites, with the sole exception of the top-most navigation. (I realise we're not exactly using tenants as designed in the case of the nav, but just looking for the best workaround for our requirements).